Dedecms
by Dedecms
Source repositories
CVEs (173)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-10375 | Cri | 0.64 | 9.8 | 0.01 | Apr 25, 2018 | A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is… | ||
| CVE-2018-9175 | Cri | 0.64 | 9.8 | 0.02 | Apr 2, 2018 | DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php. | ||
| CVE-2018-9174 | Cri | 0.64 | 9.8 | 0.01 | Apr 2, 2018 | sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control. | ||
| CVE-2017-17730 | Cri | 0.64 | 9.8 | 0.01 | Dec 18, 2017 | DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php. | ||
| CVE-2018-7700 | Hig | 0.63 | 8.8 | 0.75 | Mar 27, 2018 | DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code. | ||
| CVE-2024-33749 | Cri | 0.59 | 9.1 | 0.01 | May 6, 2024 | DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php. | ||
| CVE-2018-20129 | Hig | 0.58 | 8.8 | 0.08 | Dec 13, 2018 | An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by… | ||
| CVE-2026-29839 | Hig | 0.57 | 8.8 | 0.00 | Mar 24, 2026 | DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php. | ||
| CVE-2024-30855 | Hig | 0.57 | 8.8 | 0.00 | Dec 29, 2025 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php. | ||
| CVE-2024-46373 | Hig | 0.57 | 8.8 | 0.00 | Sep 18, 2024 | Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend. | ||
| CVE-2024-28673 | Hig | 0.57 | 8.8 | 0.00 | Mar 13, 2024 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php. | ||
| CVE-2024-28671 | Hig | 0.57 | 8.8 | 0.01 | Mar 13, 2024 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php. | ||
| CVE-2024-28684 | Hig | 0.57 | 8.8 | 0.00 | Mar 13, 2024 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php | ||
| CVE-2024-28675 | Hig | 0.57 | 8.8 | 0.00 | Mar 13, 2024 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php | ||
| CVE-2024-28665 | Hig | 0.57 | 8.8 | 0.00 | Mar 13, 2024 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.php | ||
| CVE-2024-28432 | Hig | 0.57 | 8.8 | 0.00 | Mar 13, 2024 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php. | ||
| CVE-2024-28431 | Hig | 0.57 | 8.8 | 0.00 | Mar 13, 2024 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php. | ||
| CVE-2023-52047 | Hig | 0.57 | 8.8 | 0.00 | Feb 28, 2024 | Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager. | ||
| CVE-2024-22895 | Hig | 0.57 | 8.8 | 0.01 | Jan 22, 2024 | DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php. | ||
| CVE-2023-43275 | Hig | 0.57 | 8.8 | 0.00 | Nov 16, 2023 | Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form. |
- risk 0.64cvss 9.8epss 0.01
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is…
- risk 0.64cvss 9.8epss 0.02
DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php.
- risk 0.64cvss 9.8epss 0.01
sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control.
- risk 0.64cvss 9.8epss 0.01
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.
- risk 0.63cvss 8.8epss 0.75
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code.
- risk 0.59cvss 9.1epss 0.01
DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.
- risk 0.58cvss 8.8epss 0.08
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by…
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
- risk 0.57cvss 8.8epss 0.00
Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.
- risk 0.57cvss 8.8epss 0.01
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php.
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.php
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.
- risk 0.57cvss 8.8epss 0.00
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.
- risk 0.57cvss 8.8epss 0.00
Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.
- risk 0.57cvss 8.8epss 0.01
DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.
- risk 0.57cvss 8.8epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.
Page 2 of 9